> One threat we’re particularly focused on is prompt injection, and we handle it in layers. The model is trained to recognize and resist it. The harness marks anything coming from an untrusted source. Deterministic code checks the result. And an ensemble of classifiers runs where the agent can't reach them.
> One threat we’re particularly focused on is prompt injection, and we handle it in layers. The model is trained to recognize and resist it. The harness marks anything coming from an untrusted source. Deterministic code checks the result. And an ensemble of classifiers runs where the agent can't reach them.
That "deterministic code" bit makes me wonder if they've implemented ideas from the DeepMind CaMeL paper: https://arxiv.org/abs/2503.18813 - my notes on that paper here: https://simonwillison.net/2025/Apr/11/camel/